Vulnerability · Published Oct 24, 2026 · Assigned by Grayback

CVE-2026-115998IDOR: User reads and modifies findings from other people's projects

Medium 4.3

In plain English

A medium-severity authorization bypass via user-controlled key in cervantes from CervantesSec. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.2%top 90.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

IDOR in Cervantes version v1.3-beta could allow an authenticated attacker ca access sensitive findings, proof-of-concept details, credentials, and client information from projects they do not belong to. Additionally, they can modify finding statuses and transfer findings to their own projects, compromising data confidentiality and integrity.

Affected products (as reported)

Vendor	Product	Versions
CervantesSec	cervantes	alpha 0.3 – through 1.3-beta

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References

https://www.grayback.es/advisories patch
https://www.grayback.es/en/advisories patch